Privacy Policy

Last Updated: August 26, 2026

Tha Daily Special ("we," "our," "us") runs the website at thadailyspecial.com and the Tha Daily Special mobile apps for iOS and Android. This policy explains what we collect, why, who we share it with, and the choices you have. We've written it in plain language and kept it specific to what we actually do.

The short version

We collect what we need to run your account, your Grubb Club membership, the member chat, and the emails and notifications you ask for.

We do not sell your personal information, and we don't run third-party advertising or tracking on our site or in our apps. We do count how many people read each page, but we do that ourselves, without cookies and without keeping your IP address.

We never see or store your full card number. Payments are handled entirely by Stripe.

You can delete your account and its data yourself, at any time. There's a page that walks you through it: Delete your account.

Information we collect

Information you give us

Account information. Your email address, a password (stored only as a secure hash, never in plain text), and optionally your name.

Your public profile. If you choose a username, it's stored with your account and shown to other members alongside anything you post in chat. If you upload a profile picture, we store that image and show it in the same places. Both are optional, though a username is required before you can post in chat, so other members know who they're talking to. Your real name and email address stay private and are never shown to other members.

Grubb Club membership. If you join, we store your membership status, the date you joined, your renewal date, whether you've cancelled, and identifiers that link your account to your subscription in Stripe. We never receive or store your full card number, CVC, or expiration date. Stripe collects and stores those directly.

Chat messages. If you post in the Grubb Lounge, we store what you write, up to 2,000 characters per message, along with who wrote it and when. We also store your reactions, your replies, which messages you've read, and anyone you've blocked. Chat is for members and is not public: you can't read it without signing in as a member, so it isn't visible to search engines or to anyone who hasn't joined.

Pictures, video and GIFs you send in chat. If you attach a photo, your browser or app resizes it and we store the image. If you attach a video, we store the video. If you send a GIF, we store a link to it rather than a copy. See "Chat" below for the detail.

Messages you send us. If you use our contact form, we store your name, email, any phone number you provide, and your message so we can reply.

Newsletter signup. If you subscribe, we store your email address and any first name or location you choose to give.

Event and business submissions. If you submit an event or apply to the vendor program, we store what you enter, including your contact details and any phone number you give us.

Information collected automatically

Push notification tokens (apps only). If you allow notifications, your phone issues a device token that lets us send them. On iPhone and iPad that token comes from Apple; on Android it comes from Google. We store the token and link it to your account. It does not identify you personally on its own, and it can't read anything on your device. See "Push notifications" below.

Standard technical data. Like nearly all websites, our hosting provider automatically logs basic request data such as IP address, browser type, and pages requested, for security, abuse prevention, and reliability. We also apply basic rate limiting to protect forms and chat from spam.

Essential cookies. We use cookies to keep you signed in and to remember whether you've dismissed our newsletter prompt. We do not use advertising or cross-site tracking cookies.

Page view counts. We keep a count of which pages get read, which ones people arrive from, roughly what kind of device they're on, and which country the request came from, so we know what's worth writing more of. This runs on our own servers. Google, Facebook and other outside companies get none of it, and it sets no cookie, which is why this site has never asked you to accept one.

To tell one visit apart from another within a single day, we turn your IP address and browser into a scrambled code using a secret key. We never store your IP address itself, and we destroy that key after 48 hours, so once a day has passed the code cannot be traced back to anyone, including by us. Because the key changes every day, we cannot follow you from one day to the next or across any other website.

We never ask your device for your location. Our apps request no location permission and contain no location tracking. The country recorded with a page view is worked out from the network connection by our hosting provider, and it's country-level only, nothing narrower.

This applies in both apps too, since the apps show the same pages.

Chat

The Grubb Lounge is our members-only chat. A few specifics worth knowing:

What other members see. Your username, your profile picture, and what you post. Not your name, not your email address.

Deleting your own messages. You can delete anything you've posted, and it disappears from the room straight away. We keep a hidden copy for 30 days so that reports and moderation decisions still have something to point at, and after that it's permanently deleted. One exception: if other members have replied underneath your message, the hidden copy stays, because removing it would delete their replies too.

Pictures and video. Images and videos you send in chat are stored with Cloudflare R2, our storage provider. Anything that gets uploaded but never actually sent is automatically swept up and deleted.

GIFs. The GIF search box is powered by Klipy, a third-party GIF service. When you type in it, your search text is sent to Klipy so they can return results. We do not send them anything that identifies you: not your account, not your username, not an advertising ID. Their API offers an optional customer identifier for personalisation and ad targeting, and we deliberately leave it empty. When you send a GIF we store a link to Klipy's copy, not the image itself.

Moderation. Every message has a Report option, and our moderators can remove messages, mute, or remove people from the chat. See our Community Guidelines for the house rules.

How we use your information

• To create and maintain your account and sign you in.
• To provide Grubb Club membership benefits and keep your membership status current.
• To run the member chat and moderate it.
• To process your subscription payments through Stripe.
• To send transactional email you'd expect: email confirmation, password resets, and billing notices.
• To send our newsletter and push notifications, when you've opted in.
• To respond to your messages and support requests.
• To keep the service secure, prevent abuse and spam, and fix problems.
• To meet legal, tax, and accounting obligations.

Service providers we share data with

We share personal information only with the providers that make the service work. Each one only receives what it needs, and each processes data on our behalf.

• Supabase. Hosts our database and handles account authentication: your email, password hash, profile, username, membership status, and chat messages.
• Stripe. Processes all payments and subscription billing. Stripe receives your email and payment details directly and is the sole holder of your card data. See Stripe's privacy policy.
• Brevo. Delivers our transactional email: confirmations, password resets, contact-form notifications.
• Kit (formerly ConvertKit). Delivers our newsletter, if you subscribe.
• Apple. Delivers push notifications to our iPhone and iPad app through the Apple Push Notification service.
• Google (Firebase Cloud Messaging). Delivers push notifications to our Android app. Google receives the device token and the notification text in order to hand it to your phone.
• Klipy. Powers GIF search in chat, and receives your search text. Nothing that identifies you is sent with it.
• Vercel. Hosts the website and app backend.
• Cloudflare R2. Stores and serves our images and media, including profile pictures and chat images.
• Cloudflare Turnstile. Runs the "are you human" check on sign-up, sign-in, password reset and vendor applications. It looks at signals from your browser and your IP address to tell a person from a bot. It does not track you across other websites, and we never see the raw signals.

We may also disclose information if we're legally required to, or where necessary to protect our rights, safety, or the safety of others. If our business is ever sold or transferred, account information may be part of that transfer; we'd notify you first.

We do not sell your personal information, and we do not share it with advertisers.

Push notifications

Our apps can send push notifications about new recipes, food news, chat replies, and Grubb Club perks. These are entirely optional:

• Your phone asks your permission before we can send any. If you decline, we send none. iPhone shows that prompt once per install. Android shows it too on Android 13 and newer, and will ask again if you dismiss it, so declining once isn't final.
• You can turn them off at any time, either in the app's own notification settings or in your phone's Settings app.
• Android groups our notifications into a channel you can manage or silence from your phone's settings, separately from turning them off entirely.
• We delete your device token when you turn notifications off, sign out, or delete your account.

Your choices and rights

Delete your account. Visit Delete your account for the full instructions. The short version: sign in, open Account settings, and use the "Delete account" option at the bottom. This permanently removes your account, your profile, your username and profile picture, your chat messages, and your notification tokens, and it immediately cancels any active Grubb Club membership so you aren't charged again. It can't be undone. If you can't sign in, email hello@thadailyspecial.com and we'll do it for you.

Update your information. You can change your name, username, profile picture, email address, and password from your account settings at any time.

Unsubscribe from the newsletter. Every newsletter has an unsubscribe link at the bottom, and there's a switch in your account settings.

Turn off push notifications. Use the app's notification settings or your phone's Settings, as described above.

Cancel your membership. Manage or cancel anytime from your member dashboard, through Stripe's secure billing portal.

Block another member. In chat, you can block anyone and you'll stop seeing their messages.

Request a copy or deletion of your data. Email us at hello@thadailyspecial.com and we'll help.

If you live in California, you have the right to know what personal information we collect, to request its deletion, and not to be discriminated against for exercising those rights. Because we don't sell personal information, there's nothing to opt out of, but you're welcome to contact us with any request.

How long we keep your data

• Account and profile data, including your username and profile picture: for as long as your account exists. Deleting your account removes it.
• Chat messages: for as long as your account exists, so the community can look back on recommendations and plans. Deleting your account deletes your messages with it. Messages you delete yourself are hidden from other members immediately and permanently deleted 30 days later, unless other members replied underneath, in which case the hidden copy stays so their replies survive.
• Chat images and video: for as long as the message they're attached to. Anything uploaded but never sent is deleted automatically.
• Push notification tokens: until you turn notifications off, sign out, delete the app, or delete your account.
• Payment and subscription records: retained by Stripe and by us as needed for tax, accounting, and legal requirements, even after account deletion.
• Contact form messages, event submissions and vendor applications: kept while we handle your request and for a reasonable period afterward. These are stored separately from your account, so deleting your account doesn't remove them. Email us if you'd like them removed too.
• Page view records. The detailed log is deleted after 45 days. What remains is an anonymous daily tally, such as "412 people read the site on Tuesday", which is not tied to any person or device.
• Newsletter subscription: until you unsubscribe.

Security

Data is transmitted over encrypted connections (HTTPS). Passwords are stored only as secure hashes. Access to member data is restricted at the database level, and card data never touches our servers. No system is perfectly secure, but we take reasonable measures to protect your information.

Children's privacy

You must be at least 13 years old to create an account. Our service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us at hello@thadailyspecial.com and we'll delete it.

Changes to this policy

If we make meaningful changes, we'll update the "Last Updated" date above and, where appropriate, let you know by email or in the app.

Contact us

Questions about this policy or your data? Email hello@thadailyspecial.com or use our contact form. Tha Daily Special is based in Charlotte, North Carolina, USA, and serves food lovers there and beyond.